---
id: ADR-PFM-TNL-001
title: Lifecycle and Workspace Administration Boundaries
product_area: platform
module: tenant-lifecycle
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Assign lifecycle orchestration and participant contracts to workspace lifecycle, while workspace administration
  retains customer records, business standing and HQ browsing.
constrains:
- DOM-PFM-TNL-001
- DOM-PFM-TNL-002
- DOM-PFM-TNL-003
- DOM-PFM-TNL-004
- DOM-PFM-TNL-005
- SVC-PFM-TNL-tenants
- RESP-PFM
origin: MOD-PFM-TNL charter (planning, 2026-10-22); OQ-PFM-SEC-001; FND-PFM-TNL-036
alternatives:
- option: Keep everything about workspaces in workspace administration
  why_not: Combining both concerns would obscure the independent orchestration records and safeguards.
- option: Split the source module in code first
  why_not: A physical refactor is an implementation choice and need not precede a specification boundary.
consequences:
- Lifecycle-specific operations belong with orchestration; ordinary workspace operations remain with administration.
- The overlapping Security design needs a coordinated revision to establish one home for lifecycle facts.
- Lifecycle services retain responsibility for system-owned state on the workspace row.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: modules/tenants/** (route files, services); rhythm-v2-docs: specs/platform/tenant-lifecycle/MODULE.md;
  specs/platform/security/MODULE.md.'
---

# Lifecycle and Workspace Administration Boundaries

## Context

The shared source module contains both record administration and coordination across applications. Specification ownership follows the behavior rather than requiring a source-directory split.

## Decision

Assign lifecycle orchestration and participant contracts to workspace lifecycle, while workspace administration retains customer records, business standing and HQ browsing.

## Alternatives Considered

Keep everything about workspaces in workspace administration: Combining both concerns would obscure the independent orchestration records and safeguards. Split the source module in code first: A physical refactor is an implementation choice and need not precede a specification boundary.

## Consequences

Lifecycle-specific operations belong with orchestration; ordinary workspace operations remain with administration. The overlapping Security design needs a coordinated revision to establish one home for lifecycle facts. Lifecycle services retain responsibility for system-owned state on the workspace row.